/*     */ package com.zimbra.cs.account.accesscontrol;
/*     */ 
/*     */ import com.zimbra.common.account.Key.AccountBy;
/*     */ import com.zimbra.common.account.Key.DistributionListBy;
/*     */ import com.zimbra.common.account.Key.DomainBy;
/*     */ import com.zimbra.common.service.ServiceException;
/*     */ import com.zimbra.common.util.Log;
/*     */ import com.zimbra.common.util.ZimbraLog;
/*     */ import com.zimbra.cs.account.Account;
/*     */ import com.zimbra.cs.account.DistributionList;
/*     */ import com.zimbra.cs.account.Domain;
/*     */ import com.zimbra.cs.account.Group;
/*     */ import com.zimbra.cs.account.GuestAccount;
/*     */ import com.zimbra.cs.account.MailTarget;
/*     */ import com.zimbra.cs.account.Provisioning;
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ public class ZimbraACE
/*     */ {
/*     */   private static final char S_DELIMITER = ' ';
/*     */   private static final String S_SECRET_DELIMITER = ":";
/*     */   private String mGrantee;
/*     */   private final GranteeType mGranteeType;
/*     */   private Right mRight;
/*     */   private RightModifier mRightModifier;
/*     */   private String mSecret;
/*     */   private TargetType mTargetType;
/*     */   private String mTargetName;
/*     */   
/*     */   private String[] getParts(String ace)
/*     */     throws ServiceException
/*     */   {
/* 112 */     int p3 = ace.lastIndexOf(' ');
/* 113 */     if (p3 == -1) {
/* 114 */       throw ServiceException.PARSE_ERROR("bad ACE: " + ace, null);
/*     */     }
/* 116 */     int p2 = ace.lastIndexOf(' ', p3 - 1);
/* 117 */     if (p2 == -1) {
/* 118 */       throw ServiceException.PARSE_ERROR("bad ACE: " + ace, null);
/*     */     }
/* 120 */     String[] parts = new String[3];
/* 121 */     parts[0] = ace.substring(0, p2);
/* 122 */     parts[1] = ace.substring(p2 + 1, p3);
/* 123 */     parts[2] = ace.substring(p3 + 1);
/* 124 */     return parts;
/*     */   }
/*     */   
/*     */   public static class ExternalGroupInfo
/*     */   {
/*     */     private final String zimbraDomain;
/*     */     private final String extGroupName;
/*     */     
/*     */     private ExternalGroupInfo(String zimbraDomain, String externalGroupName)
/*     */     {
/* 134 */       this.zimbraDomain = zimbraDomain;
/* 135 */       this.extGroupName = externalGroupName;
/*     */     }
/*     */     
/*     */     String getZimbraDmain() {
/* 139 */       return this.zimbraDomain;
/*     */     }
/*     */     
/*     */     String getExternalGroupName() {
/* 143 */       return this.extGroupName;
/*     */     }
/*     */     
/*     */     static ExternalGroupInfo parse(String grantee) throws ServiceException
/*     */     {
/* 148 */       String[] parts = grantee.split(":");
/* 149 */       if (parts.length != 2) {
/* 150 */         throw ServiceException.PARSE_ERROR("invalid external group grantee " + grantee, null);
/*     */       }
/*     */       
/* 153 */       return new ExternalGroupInfo(parts[0], parts[1]);
/*     */     }
/*     */     
/*     */     static String encode(String zimbraDomain, String extGroupName) {
/* 157 */       return zimbraDomain + ":" + extGroupName;
/*     */     }
/*     */     
/*     */     public static String encodeIfExtGroupNameMissingDomain(String zimbraDomain, String extGroupName) {
/* 161 */       if (extGroupName.contains(":")) {
/* 162 */         return extGroupName;
/*     */       }
/* 164 */       return encode(zimbraDomain, extGroupName);
/*     */     }
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */   ZimbraACE(String ace, RightManager rm, TargetType targetType, String targetName)
/*     */     throws ServiceException
/*     */   {
/* 185 */     String[] parts = getParts(ace);
/*     */     
/*     */ 
/*     */ 
/*     */ 
/* 190 */     String grantee = parts[0];
/* 191 */     this.mGranteeType = GranteeType.fromCode(parts[1]);
/* 192 */     String right = parts[2];
/*     */     
/* 194 */     switch (this.mGranteeType) {
/*     */     case GT_USER: 
/*     */     case GT_GROUP: 
/*     */     case GT_DOMAIN: 
/*     */     case GT_AUTHUSER: 
/*     */     case GT_PUBLIC: 
/* 200 */       if (!Provisioning.isUUID(grantee)) {
/* 201 */         throw ServiceException.PARSE_ERROR("grantee ID [" + grantee + "] is not a UUID", null);
/*     */       }
/* 203 */       this.mGrantee = grantee;
/* 204 */       break;
/*     */     
/*     */ 
/*     */ 
/*     */ 
/*     */     case GT_EXT_GROUP: 
/* 210 */       this.mGrantee = grantee;
/* 211 */       break;
/*     */     case GT_EXT_DOMAIN: 
/* 213 */       this.mGrantee = grantee;
/* 214 */       break;
/*     */     case GT_GUEST: 
/*     */     case GT_KEY: 
/* 217 */       String[] externalParts = grantee.split(":");
/* 218 */       if ((externalParts.length != 1) && (externalParts.length != 2)) {
/* 219 */         throw ServiceException.PARSE_ERROR("bad ACE(guest/key grantee must have two sub parts): " + ace, null);
/*     */       }
/*     */       
/* 222 */       this.mGrantee = decodeGrantee(externalParts[0]);
/* 223 */       if (externalParts.length == 2) {
/* 224 */         this.mSecret = decodeSecret(externalParts[1]);
/*     */       } else {
/* 226 */         this.mSecret = null;
/*     */       }
/* 228 */       break;
/*     */     case GT_EMAIL: 
/* 230 */       this.mGrantee = grantee;
/* 231 */       break;
/*     */     default: 
/* 233 */       throw ServiceException.PARSE_ERROR("invalid grantee type " + this.mGranteeType, null);
/*     */     }
/*     */     
/* 236 */     this.mRightModifier = RightModifier.fromChar(right.charAt(0));
/* 237 */     if (this.mRightModifier == null) {
/* 238 */       this.mRight = rm.getRight(right);
/*     */     } else {
/* 240 */       this.mRight = rm.getRight(right.substring(1));
/*     */     }
/* 242 */     this.mTargetType = targetType;
/* 243 */     this.mTargetName = targetName;
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */   public ZimbraACE(String granteeId, GranteeType granteeType, Right right, RightModifier rightModifier, String secret)
/*     */     throws ServiceException
/*     */   {
/* 251 */     this.mGranteeType = granteeType;
/*     */     
/* 253 */     if (this.mGranteeType == GranteeType.GT_AUTHUSER) {
/* 254 */       this.mGrantee = "00000000-0000-0000-0000-000000000000";
/* 255 */     } else if (this.mGranteeType == GranteeType.GT_PUBLIC) {
/* 256 */       this.mGrantee = "99999999-9999-9999-9999-999999999999";
/*     */     } else {
/* 258 */       this.mGrantee = granteeId;
/*     */     }
/*     */     
/* 261 */     this.mRightModifier = rightModifier;
/* 262 */     this.mRight = right;
/* 263 */     this.mSecret = secret;
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */   private ZimbraACE(ZimbraACE other)
/*     */   {
/* 272 */     this.mGrantee = new String(other.mGrantee);
/* 273 */     this.mGranteeType = other.mGranteeType;
/* 274 */     this.mRight = other.mRight;
/* 275 */     this.mRightModifier = other.mRightModifier;
/* 276 */     if (other.mSecret != null) {
/* 277 */       this.mSecret = new String(other.mSecret);
/*     */     }
/* 279 */     this.mTargetType = other.mTargetType;
/* 280 */     this.mTargetName = other.mTargetName;
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */   public ZimbraACE clone()
/*     */   {
/* 288 */     return new ZimbraACE(this);
/*     */   }
/*     */   
/*     */   private String encodeGrantee(String granteeName)
/*     */   {
/* 293 */     return granteeName;
/*     */   }
/*     */   
/*     */   private String decodeGrantee(String granteeName) throws ServiceException
/*     */   {
/* 298 */     return granteeName;
/*     */   }
/*     */   
/*     */   private String encodeSecret(String secret)
/*     */   {
/* 303 */     if (secret == null) {
/* 304 */       return "";
/*     */     }
/* 306 */     return secret;
/*     */   }
/*     */   
/*     */   private String decodeSecret(String secret) throws ServiceException
/*     */   {
/* 311 */     return secret;
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */   public boolean isGrantee(String principalId)
/*     */   {
/* 324 */     if ((principalId == null) || (principalId.equals("99999999-9999-9999-9999-999999999999")))
/* 325 */       return this.mGranteeType == GranteeType.GT_PUBLIC;
/* 326 */     if (principalId.equals("00000000-0000-0000-0000-000000000000"))
/* 327 */       return this.mGranteeType == GranteeType.GT_AUTHUSER;
/* 328 */     return principalId.equals(this.mGrantee);
/*     */   }
/*     */   
/*     */   public String getGrantee() {
/* 332 */     return this.mGrantee;
/*     */   }
/*     */   
/*     */   public GranteeType getGranteeType() {
/* 336 */     return this.mGranteeType;
/*     */   }
/*     */   
/*     */   public Right getRight() {
/* 340 */     return this.mRight;
/*     */   }
/*     */   
/*     */   public boolean deny() {
/* 344 */     return this.mRightModifier == RightModifier.RM_DENY;
/*     */   }
/*     */   
/*     */   public boolean canDelegate() {
/* 348 */     return this.mRightModifier == RightModifier.RM_CAN_DELEGATE;
/*     */   }
/*     */   
/*     */   public boolean subDomain() {
/* 352 */     return this.mRightModifier == RightModifier.RM_SUBDOMAIN;
/*     */   }
/*     */   
/*     */   public boolean disinheritSubGroups() {
/* 356 */     return this.mRightModifier == RightModifier.RM_DISINHERIT_SUB_GROUPS;
/*     */   }
/*     */   
/*     */   public boolean canExecuteOnly() {
/* 360 */     return (!canDelegate()) && (!deny());
/*     */   }
/*     */   
/*     */   public String getSecret() {
/* 364 */     return this.mSecret;
/*     */   }
/*     */   
/*     */   public void setSecret(String secret) {
/* 368 */     this.mSecret = secret;
/*     */   }
/*     */   
/*     */   RightModifier getRightModifier() {
/* 372 */     return this.mRightModifier;
/*     */   }
/*     */   
/*     */   void setRightModifier(RightModifier rightModifier) {
/* 376 */     this.mRightModifier = rightModifier;
/*     */   }
/*     */   
/*     */   void setRight(Right right)
/*     */   {
/* 381 */     this.mRight = right;
/*     */   }
/*     */   
/*     */   TargetType getTargetType() {
/* 385 */     return this.mTargetType;
/*     */   }
/*     */   
/*     */   String getTargetName() {
/* 389 */     return this.mTargetName;
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */   private boolean matches(MailTarget mailTarget, boolean asAdmin)
/*     */     throws ServiceException
/*     */   {
/* 397 */     Provisioning prov = Provisioning.getInstance();
/* 398 */     if (mailTarget == null)
/* 399 */       return this.mGranteeType == GranteeType.GT_PUBLIC;
/* 400 */     switch (this.mGranteeType) {
/*     */     case GT_PUBLIC: 
/* 402 */       return true;
/*     */     case GT_AUTHUSER: 
/* 404 */       if ((mailTarget instanceof Account)) {
/* 405 */         return !(mailTarget instanceof GuestAccount);
/*     */       }
/* 407 */       return false;
/*     */     
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */     case GT_GROUP: 
/* 414 */       return prov.inDistributionList(mailTarget, this.mGrantee);
/*     */     case GT_EXT_GROUP: 
/* 416 */       ExternalGroup extGroup = ExternalGroup.get(Key.DomainBy.id, this.mGrantee, asAdmin);
/* 417 */       if (extGroup == null) {
/* 418 */         ZimbraLog.account.warn("unable to find external group grantee " + this.mGrantee);
/* 419 */         return false;
/*     */       }
/* 421 */       return extGroup.inGroup(mailTarget, asAdmin);
/*     */     case GT_DOMAIN: 
/* 423 */       return this.mGrantee.equals(mailTarget.getDomainId());
/*     */     case GT_EXT_DOMAIN: 
/* 425 */       return matchesDomainForGuest(mailTarget);
/*     */     case GT_USER: 
/* 427 */       return this.mGrantee.equals(mailTarget.getId());
/*     */     case GT_GUEST: 
/* 429 */       return matchesGuestAccount(mailTarget);
/*     */     case GT_KEY: 
/* 431 */       return matchesAccessKey(mailTarget);
/*     */     case GT_EMAIL: 
/* 433 */       return matchesEmail(mailTarget, asAdmin);
/*     */     }
/* 435 */     throw ServiceException.FAILURE("unknown ACL grantee type: " + this.mGranteeType, null);
/*     */   }
/*     */   
/*     */   private boolean matchesEmail(MailTarget mailTarget, boolean asAdmin)
/*     */   {
/* 440 */     if ((mailTarget instanceof GuestAccount))
/* 441 */       return matchesGuestAccount(mailTarget);
/* 442 */     if ((mailTarget instanceof Account))
/* 443 */       return this.mGrantee.equalsIgnoreCase(mailTarget.getName());
/* 444 */     if ((mailTarget instanceof DistributionList)) {
/* 445 */       return this.mGrantee.equalsIgnoreCase(mailTarget.getName());
/*     */     }
/* 447 */     return false;
/*     */   }
/*     */   
/*     */   private boolean matchesGuestAccount(MailTarget acct) {
/* 451 */     if (!(acct instanceof GuestAccount))
/* 452 */       return false;
/* 453 */     return ((GuestAccount)acct).matches(this.mGrantee, this.mSecret);
/*     */   }
/*     */   
/*     */   private boolean matchesAccessKey(MailTarget acct) {
/* 457 */     if (!(acct instanceof GuestAccount))
/* 458 */       return false;
/* 459 */     return ((GuestAccount)acct).matchesAccessKey(this.mGrantee, this.mSecret);
/*     */   }
/*     */   
/*     */   private boolean matchesDomainForGuest(MailTarget acct) {
/* 463 */     return this.mGrantee.equalsIgnoreCase(acct.getDomainName());
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */   boolean matchesGrantee(MailTarget grantee, boolean asAdmin)
/*     */     throws ServiceException
/*     */   {
/* 475 */     return matches(grantee, asAdmin);
/*     */   }
/*     */   
/*     */   public String getGranteeDisplayName() {
/*     */     try {
/* 480 */       switch (this.mGranteeType) {
/*     */       case GT_USER: 
/* 482 */         Account acct = Provisioning.getInstance().get(Key.AccountBy.id, this.mGrantee);
/* 483 */         if (acct != null) {
/* 484 */           return acct.getName();
/*     */         }
/*     */         break;
/*     */       case GT_GROUP: 
/* 488 */         Group group = Provisioning.getInstance().getGroupBasic(Key.DistributionListBy.id, this.mGrantee);
/*     */         
/* 490 */         if (group != null) {
/* 491 */           return group.getName();
/*     */         }
/*     */         break;
/*     */       case GT_EXT_GROUP: 
/* 495 */         ExternalGroupInfo extGroupInfo = ExternalGroupInfo.parse(this.mGrantee);
/* 496 */         return extGroupInfo.getExternalGroupName();
/*     */       case GT_DOMAIN: 
/* 498 */         Domain domain = Provisioning.getInstance().get(Key.DomainBy.id, this.mGrantee);
/* 499 */         if (domain != null) {
/* 500 */           return domain.getName();
/*     */         }
/*     */         break;
/*     */       case GT_EXT_DOMAIN: 
/*     */       case GT_GUEST: 
/*     */       case GT_KEY: 
/* 506 */         return this.mGrantee;
/*     */       case GT_AUTHUSER: 
/*     */       case GT_PUBLIC: 
/*     */       default: 
/* 510 */         return null;
/*     */       }
/*     */     } catch (ServiceException e) {
/* 513 */       ZimbraLog.acl.warn("cannot get grantee name for " + this.mGrantee, e);
/*     */     }
/* 515 */     return null;
/*     */   }
/*     */   
/*     */   public String serialize()
/*     */   {
/* 520 */     StringBuffer sb = new StringBuffer();
/*     */     
/*     */ 
/* 523 */     if ((this.mGranteeType == GranteeType.GT_GUEST) || (this.mGranteeType == GranteeType.GT_KEY)) {
/* 524 */       sb.append(encodeGrantee(this.mGrantee) + ":" + encodeSecret(this.mSecret) + ' ');
/*     */     } else {
/* 526 */       sb.append(this.mGrantee + ' ');
/*     */     }
/*     */     
/* 529 */     sb.append(getGranteeType().getCode() + ' ');
/*     */     
/*     */ 
/* 532 */     if (this.mRightModifier != null) {
/* 533 */       sb.append(this.mRightModifier.getModifier());
/*     */     }
/* 535 */     sb.append(getRight().getName());
/*     */     
/* 537 */     return sb.toString();
/*     */   }
/*     */   
/*     */   public String dump(boolean verbose)
/*     */   {
/* 542 */     if (verbose) {
/* 543 */       return "[grantee name=" + getGranteeDisplayName() + ", grantee id=" + getGrantee() + ", grantee type=" + getGranteeType().getCode() + ", right=" + getRight().getName() + "]";
/*     */     }
/*     */     
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/* 550 */     return "[(" + getGranteeDisplayName() + ") " + serialize() + "]";
/*     */   }
/*     */   
/*     */   public static void validate(ZimbraACE ace) throws ServiceException {
/* 554 */     if ((ace.mGranteeType == GranteeType.GT_GUEST) || (ace.mGranteeType == GranteeType.GT_KEY)) {
/* 555 */       if (ace.getGrantee().contains(":"))
/* 556 */         throw ServiceException.INVALID_REQUEST("grantee cannot contain::", null);
/* 557 */       if ((ace.getSecret() != null) && (ace.getSecret().contains(":"))) {
/* 558 */         throw ServiceException.INVALID_REQUEST("password/accesskey cannot contain::", null);
/*     */       }
/*     */     }
/*     */   }
/*     */ }


/* Location:              /home/mint/zimbrastore.jar!/com/zimbra/cs/account/accesscontrol/ZimbraACE.class
 * Java compiler version: 7 (51.0)
 * JD-Core Version:       0.7.1
 */